From 49fb4b37b7c86502411acdf075d634ff5ac212e3 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sat, 1 Nov 2025 11:16:46 +0100 Subject: [PATCH] more corrections --- .../docs/ispmail-trixie/165-dovecot.mdx | 6 +- .../docs/ispmail-trixie/170-webmail.mdx | 4 +- .../docs/ispmail-trixie/180-relaying.mdx | 84 ++++++++++-------- .../200-managing-users-aliases-domains.mdx | 22 +++-- .../images/roundcube-password.png | Bin 0 -> 31428 bytes 5 files changed, 68 insertions(+), 48 deletions(-) create mode 100644 src/content/docs/ispmail-trixie/images/roundcube-password.png diff --git a/src/content/docs/ispmail-trixie/165-dovecot.mdx b/src/content/docs/ispmail-trixie/165-dovecot.mdx index bf30daf..01ab6c4 100644 --- a/src/content/docs/ispmail-trixie/165-dovecot.mdx +++ b/src/content/docs/ispmail-trixie/165-dovecot.mdx @@ -68,7 +68,7 @@ mail_home = /var/vmail/%{user | domain}/%{user | username} mail_path = ~/Maildir mail_uid = vmail mail_gid = vmail -mail_inbox_path = +mail_inbox_path = ~/Maildir/ EOF ``` @@ -83,7 +83,9 @@ This looks more sophisticated than with versions of Dovecot before 2.4. What it is that we will store other data in the user's _home_ directory as well that should not conflict with the mailbox directory. - **mail_uid**/**mail_gid**: All mailboxes will be owned be the user and group `vmail`. -- **mail_inbox_path**: We just un-set this because it would conflict with the _mail_path_ that is set in `10-mail.conf` +- **mail_inbox_path**: A user's main inbox consists of the directories `cur` and `new` inside the Maildir directory. We + used that schema in previous guides and make sure you can migrate your mailboxes from other mail servers. This + overrides the setting in in `10-mail.conf`. ### 10-master.conf / 99-ispmail-master.conf diff --git a/src/content/docs/ispmail-trixie/170-webmail.mdx b/src/content/docs/ispmail-trixie/170-webmail.mdx index 5bb56fc..7490028 100644 --- a/src/content/docs/ispmail-trixie/170-webmail.mdx +++ b/src/content/docs/ispmail-trixie/170-webmail.mdx @@ -137,7 +137,7 @@ plugins change it to: ``` $config['plugins'] = array( 'password', - ); +); ``` Plugins are configured through files located in the `/etc/roundcube/plugins` directory. Let's quickly set up the @@ -184,6 +184,8 @@ For a complete reference please see `/usr/share/roundcube/plugins/password/confi The last two lines make sure that this config file is only accessible to everyone. +![Roundcube password dialog](images/roundcube-password.png) + Try it. Log into Roundcube as `john@example.org` with password ‘summersun’. Go to the _Settings_. Choose _Password_. Enter a new password twice. You should get a success message at the bottom right. Now logout and login with the new password. Does it work? Great. diff --git a/src/content/docs/ispmail-trixie/180-relaying.mdx b/src/content/docs/ispmail-trixie/180-relaying.mdx index 71a3121..8c4ff3e 100644 --- a/src/content/docs/ispmail-trixie/180-relaying.mdx +++ b/src/content/docs/ispmail-trixie/180-relaying.mdx @@ -15,18 +15,18 @@ Let's begin with the difference of how **users** send emails versus how **mail s - A **mail server** fetches the _MX_ record for the destination domain of the recipient’s email address from DNS. That tells it which mail server to talk to. Then it opens an SMTP connection (TCP port 25) and sends the email. A mail - server will not relay an email. It will only accept it for its own users. + server will not relay an email meant for someone else. It will only accept emails for its own users. - An **end user** with a mail client such as Thunderbird or Roundcube cannot do that. Mail clients do not include any functionality for fetching MX records. In addition, the user is usually on a dynamic IP address that other mail servers will not trust and will likely reject. Instead, end users are expected to send their emails through their - provider’s (your) mail server: they authenticate with their login credentials and then send the message. This process + provider’s (=your) mail server: they authenticate with their login credentials and then send the message. This process is called relaying, because your mail server acts as an intermediary between the user and other mail servers on the internet. For security reasons, authentication is required before the user is allowed to send emails. Users are also expected to use the TCP port 587 which is called the _submission_ port. More on that later. -Postfix must only accept an email from a user, if… +Postfix must only accept an email **from a user**, if… -- The user uses the **submission** port (and not the standard **SMTP** port) +- The user uses the **submission** port (and not the standard SMTP port) - The user **authenticates** with the username (in our setup: the email address) and the password - The connection is **encrypted** so that the password can be safely transmitted - The **sender address** of the email matches the user's account @@ -69,7 +69,7 @@ postconf -P "submission/inet/syslog_name=postfix/submission" postconf -P "submission/inet/smtpd_tls_security_level=encrypt" postconf -P "submission/inet/smtpd_sasl_auth_enable=yes" postconf -P "submission/inet/smtpd_sasl_type=dovecot" -postconf -P "submission/inet/smtpd_sasl_path=private/auth" +postconf -P "submission/inet/smtpd_sasl_path=private/dovecot-auth" postconf -P "submission/inet/smtpd_recipient_restrictions=permit_sasl_authenticated,reject" postconf -P "submission/inet/smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject" @@ -80,7 +80,7 @@ These commands added a `submission` service to the `/etc/postfix/master.cf` file by editing that file and adding the following section, but I wanted to make it simpler for you to just copy/paste the commands into your shell. -``` +```text title="What it did…" submission inet n - y - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt @@ -104,7 +104,8 @@ Some notes on that: Layer_. That way only our own users can use this service. - **smtpd_sasl_type** tells Postfix to use Dovecot's service to authentication a uaser. - **smtpd_sasl_path** tells Postfix that it should talk to Dovecot through the socket file - `/var/spool/postfix/private/auth`. Earlier in this guide you told Dovecot to create that socket at that location. + `/var/spool/postfix/private/dovecot-auth`. Earlier in this guide you told Dovecot to create that socket at that + location. - **smtpd_recipient_restrictions** define that only authenticated connections are permitted. Without a username and a password your connection will be rejected. The **recipient** keyword tells us that this restricts who the recipient can be. @@ -119,7 +120,7 @@ postconf -P "submissions/inet/syslog_name=postfix/submissions" postconf -P "submissions/inet/smtpd_tls_wrappermode=yes" postconf -P "submissions/inet/smtpd_sasl_auth_enable=yes" postconf -P "submissions/inet/smtpd_sasl_type=dovecot" -postconf -P "submissions/inet/smtpd_sasl_path=private/auth" +postconf -P "submissions/inet/smtpd_sasl_path=private/dovecot-auth" postconf -P "submissions/inet/smtpd_recipient_restrictions=permit_sasl_authenticated,reject" postconf -P "submissions/inet/smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject" postfix reload @@ -189,6 +190,7 @@ As we use the email address also as a user name we simply need a mapping where t sides. Let's create it: ```sh title="Run this on your server" +# Create a mapping configuration from the user to themself cat > /etc/postfix/mariadb-email2email.cf << EOF user = mailserver password = MAILSERVER-PASSWORD-HERE @@ -197,9 +199,11 @@ dbname = mailserver query = SELECT email FROM virtual_users WHERE email='%s' EOF +# Fix permissions chown root:postfix /etc/postfix/mariadb-email2email.cf chmod u=rw,g=r,o= /etc/postfix/mariadb-email2email.cf +# Tell Postfix to use thi smapping postconf smtpd_sender_login_maps=mysql:/etc/postfix/mariadb-email2email.cf ``` @@ -293,7 +297,7 @@ Postfix will still reject the email because we refused to authenticate: ~> MAIL FROM: <~ 250 2.1.0 Ok ~> RCPT TO: -<~* 554 5.7.1 : Sender address rejected: Access denied +<~* 553 5.7.1 : Sender address rejected: not logged in ``` ### With encryption and authentication @@ -318,8 +322,8 @@ swaks --server localhost:465 \ --auth-password summersun ``` -Did you notice the difference? This time we used port **465** and instead of the `-tls` option (which uses STARTTLS to -switch to encryption) we use `--tls-on-connect` that uses TLS right from from the start. +Did you notice the difference? The second time we used port **465** and instead of the `-tls` option (which uses +STARTTLS to switch to encryption) we use `--tls-on-connect` that uses TLS right from from the start. Put simply, a mail server will accept an email if… @@ -348,7 +352,7 @@ The server will let you in: Trying 127.0.0.1… Connected to localhost. Escape character is '^]'. -220 webmail ESMTP Postfix (Debian/GNU) +220 webmail ESMTP Postfix (Debian) ``` Say hello: @@ -376,42 +380,44 @@ Postfix will present a list of features that are available for you: Let me briefly explain what these lines mean: - PIPELINING - This is a feature to speed up SMTP communication. Usually the remote system has to wait for a response to every command - it sends. Pipelining allows the remote server to send several commands in a batch without waiting for a response. Postfix - will just store these commands and execute them one by one. If you told Postfix to forbid pipelining it would disconnect - the remote server when it tries to send bulks of commands without waiting for the proper reply. It is mainly a feature - against rogue senders. + This is a feature to speed up SMTP communication. Usually the remote system has to wait for a response to every + command it sends. Pipelining allows the remote server to send several commands in a batch without waiting for a + response. Postfix will just store these commands and execute them one by one. If you told Postfix to forbid pipelining + it would disconnect the remote server when it tries to send bulks of commands without waiting for the proper reply. It + is mainly a feature against rogue senders. - SIZE 10240000 - The remote server is allowed to send emails up to 10 MB large. This has long been a common maximum size for emails. However - nowadays 40 MB or even more are more common sizes because emails have grown larger. Some mail servers even allow 100 MB. + The remote server is allowed to send emails up to 10 MB large. This has long been a common maximum size for emails. + However nowadays 40 MB or even more are more common sizes because emails have grown larger. Some mail servers even + allow 100 MB. - VRFY - Allows remote servers to verify a given name or email address. For example the remote server could send "VRFY john" and - your server might respond `250 Jo You can skip it for now.hn Doe `. It can be used to verify that a certain - recipient email address is deliverable + Allows remote servers to verify a given name or email address. For example the remote server could send "VRFY john" + and your server might respond `250 Jo You can skip it for now.hn Doe `. It can be used to verify + that a certain recipient email address is deliverable - ETRN - A command that a remote system can send to flush the Postfix queue of mails for a certain domain. It can be used if the - remote system had technical problems and failed to receive email for a while. Then it could send an ETRN command to make - your server start sending outstanding emails for that domain. It is rarely used. + A command that a remote system can send to flush the Postfix queue of mails for a certain domain. It can be used if + the remote system had technical problems and failed to receive email for a while. Then it could send an ETRN command + to make your server start sending outstanding emails for that domain. It is rarely used. - STARTTLS - This tells the remote system that it might start switching from this unencrypted to an encrypted connection by sending - the "STARTTLS" command. It will then start negotiating a TLS-encrypted connection. You could compare it to an HTTP connection - that suddenly switches over to an encrypted HTTPS connection. The advantage is that you can start talking SMTP on TCP port - 25 and don’t have to open up a second TCP port like 465 which is the "SSMTP" (secure SMTP) port and only accepts encrypted - connections. + This tells the remote system that it might start switching from this unencrypted to an encrypted connection by + sending the "STARTTLS" command. It will then start negotiating a TLS-encrypted connection. You could compare it to an + HTTP connection that suddenly switches over to an encrypted HTTPS connection. The advantage is that you can start + talking SMTP on TCP port 25 and don’t have to open up a second TCP port like 465 which is the "SSMTP" (secure SMTP) + port and only accepts encrypted connections. - ENHANCEDSTATUSCODES - This enables more three-digit return codes for various conditions. See the [RFC2034](http://tools.ietf.org/html/rfc2034) - if you are curious. + This enables more three-digit return codes for various conditions. See the + [RFC2034](http://tools.ietf.org/html/rfc2034) if you are curious. - 8BITMIME - In ancient times SMTP only processed 7-bit characters. You couldn’t transfer special characters like "Ä" or "ß" without - special encoding. 8BITMIME allows a transmission of emails using 8-bit characters. Still many emails are specially encoded - using ISO8859-1 or UTF-8. + In ancient times SMTP only processed 7-bit characters. You couldn’t transfer special characters like "Ä" or "ß" + without special encoding. 8BITMIME allows a transmission of emails using 8-bit characters. Still many emails are + specially encoded using ISO8859-1 or UTF-8. - DSN - It enables DSNs (delivery status notofications) that allows the sender to control the messages that Postfix creates when - an email could not be delivered as intended. + It enables DSNs (delivery status notofications) that allows the sender to control the messages that Postfix creates + when an email could not be delivered as intended. - SMTPUTF8 In addition to 8BITMIME you can use UTF8 encoded characters in header fields. - CHUNKING - This feature (described in [RFC 3030](https://tools.ietf.org/html/rfc3030)) makes sending of large emails more efficient. + This feature (described in [RFC 3030](https://tools.ietf.org/html/rfc3030)) makes sending of large emails more + efficient. However one important line is missing here that would allow us to send our username and password: @@ -445,7 +451,7 @@ QUIT We can use OpenSSL to help us with the decryption. Run: ``` -openssl s_client -connect localhost:25 -starttls smtp +openssl s_client -connect localhost:submission -starttls smtp ``` You will see a lot of output. OpenSSL has connected to TCP port 25 and issued a STARTTLS command to switch to an diff --git a/src/content/docs/ispmail-trixie/200-managing-users-aliases-domains.mdx b/src/content/docs/ispmail-trixie/200-managing-users-aliases-domains.mdx index dfe7570..e228fb9 100644 --- a/src/content/docs/ispmail-trixie/200-managing-users-aliases-domains.mdx +++ b/src/content/docs/ispmail-trixie/200-managing-users-aliases-domains.mdx @@ -38,20 +38,23 @@ DELETE FROM virtual_domains where name='example.org'; Find out the `id` of the right domain from the virtual_domains table. The insert a new row into the virtual_users table. Set the domain_id to the value you just looked up in the virtual_domains table. Set the `email` field to the complete -email address of the new user. Create a new password in a shell using the `dovecot pw -s BLF-CRYPT` command and insert -the result into the `password` field. +email address of the new user. Create a new password in a shell using the `dovecot pw` command and insert the result +into the `password` field. ```sql -INSERT INTO virtual_users (domain_id, email, password) VALUES (SELECT id FROM virtual_domains WHERE name='example.org'), 'john@example.org','{BLF-CRYPT}$2y$05$.We…'; +INSERT INTO virtual_users + (domain_id, email, password) +VALUES + ((SELECT id FROM virtual_domains WHERE name='example.org'), 'john@example.org','{CRYPT}$2y$05$.We…'); ``` ### Change the password of a user Find the row in the virtual_users table by looking for the right `email` field. Create a new password in a shell using -the `dovecot pw -s BLF-CRYPT` command and insert the result into the `password` field. +the `dovecot pw` command and insert the result into the `password` field. ```sql -UPDATE virtual_users SET password='{BLF-CRYPT}$2y$05$.We…' WHERE email='email@address'; +UPDATE virtual_users SET password='{CRYPT}$2y$05$.We…' WHERE email='email@address'; ``` ### Delete a mail user @@ -72,7 +75,14 @@ destination addresses). Set the `source` field to the complete source email addr the respective complete destination email address. ```sql -INSERT INTO virtual_aliases (domain_id, source, destination) VALUES ( (SELECT id FROM virtual_domains WHERE name='example.org'), 'melissa@example.org', 'juila@example.net'); +INSERT INTO virtual_aliases + (domain_id, source, destination) +VALUES + ( + (SELECT id FROM virtual_domains WHERE name='example.org'), + 'melissa@example.org', + 'juila@example.net' + ); ``` ### Delete a mail forwarding diff --git a/src/content/docs/ispmail-trixie/images/roundcube-password.png b/src/content/docs/ispmail-trixie/images/roundcube-password.png new file mode 100644 index 0000000000000000000000000000000000000000..7b7bbde2fbc9c5cb1a54b939acb71932600c5ab7 GIT binary patch literal 31428 zcmd3NWl&sEu;xU71Pvs3fH1fRcL*@S-JRgUgS&+U1`i(G-2wv)4hin=?#|#c*iOiM z`*yeL{n%f-w{F$Q>7#w*>+f_2E6Ph?pc0`1000arNsuxC@SFqyctZQ)DdL~xZPG7@ zk7tgeQmQXryqH^2SVsILbo!|2q+)00DIt%5`hD-le>vOt0K(uPnS* z`vrZ-cR!BNFLkV^_x|;G9@xwTEwCos=X~I zjvAddW|IcyDl03UuyOxolKj1eOWoO-9fa;SCJ_~|#-pM#rqH4Yj2gczJ=oY`HR}!g zbp(Ej^{;(SIeuL>_^!Xw**va1rI4@_lakobv*pk{9Ih*`9W84caIHT*mYczkl&Dc# zr=IlQ3tZT9(;*Ls!;LC5Z(Jyij$9b7kUb!NdQ=ps3X4!&6hlyr2F2{qKVs)*X2Je0sD%K-k`lNSiRX z$x=->lz)0F|E~f8fZ=L{h&GokZI7vDjV|+$`5Jm#7y-w-^zg@IKlu&r@@1aErXnj_ z&r=QzRa@ye#^3h3_j6Ak(@A>l^p%=r>FQ+T=kyCzlZGyW!KO2t;k#Qch)IojhNEsb zaVHjv)@wr7c$lXC+%PU_bE4(^N8)!x;$TPUR!uP=G~sQ?46drmV=l$zlVpvb1jHM& zXZTDy$4WSbv6|==k4ab3-q)oql8ju?s@wMEkgxP#fxrq$O0t?n`$154)^WyAKfP6d1h?hP242dS|Qfe z+NH^@i{vk2GkoHnvH~j#)yp^{w=+m!R8c|Lglr$m{`2$!&TK;*u4Iq)7ylubLL#}(?z_= zY2|tQB9ra-uY5>v@W>C~vj%y#g4ikVs#(-#b+6BM?`N{NNP`DCS(n!^v25qN8@4(d zEP=p|x|!-dPTQ*YAEZE{X1cnT;>z_ z|D=(Mxd@KE`gpiE#aJLAaeSESss`$fQSpXV>0LGq)!k>iQmGO(c^mHiTGE#18@O_U z_3F)dZ`A$C5uL++jjYCPEJf&Iw$M0WE~dQB?Ce$Y^}haxuKD5vHN5iW)V*%g=5}d* zp~to43_E=Wbz;r^s3 z`KeR~x9slX^i=$qz#@Ci>93E;@{8^k%7b%#W7*$W#k9C5Q0R3=hz z4pV2UzUX!xQusE!%B93nzP(KI_?-+7OXRkJ$Ih(nCaYvU6#hchYw*Bd1BWrVZcpXa zBrLTe55A2mv0f9=YqA!;y2jNwY_T}_Q(Y|1&1H6dMH8tU>nfk>US^g$H+1JX5nZ~6 zqK3cqw&11jEn_kzuJ#!jpUG+ptDt99xnb#b#^U3yR}}+wH(UCxC~s+hJKwQFl_KOJ z>Ecr3@Bcd?{VN#E)k*l8kG7csCx}nD{CxKd>?E-zf>h9b>wdA0-9)_@eyWg8|6J(w zPf0p+qmXj!kDp2TD-U6rnXEFDTwLt$dKKv)Dt{?^%*!)l%tmaV8=)XdK@5+;hZ;Uiq(6lxJvoqpYxGUEDgCc%M?gy}bXWldD`f z@>yuUj4J%Y&FaPzE%9qqoM!snUoEZ%sM$u<{Nu%n<&NL$nJigIc`iU#!uV;os-auK zwMG~cSVcDHyNBtlE^K!voGTA)6)@-@f_kjQs=U$6Z2YqM7Xo$s%U4PdBgI=a5Ed}x z?{0kShPuogVz>=YUGCW95`2mF@WoDDeKLX5lUs!i*l%eUZE>F!P%dZIT}YB#V>|0C zm`DQ@XG{nNBi4P{PZj%@ZC%0&9ImAs8(NTPL(6!r9d7Rz>AtN^%!Yse6h=Z4 zrbW(r)CsW$l2cHyn}`QpeftMf+{_FoFj7#^ z+(|ki%J@#UUsj9!@MJcfCMYsRd&hC>bpw~>wv*9NcIuiZavU2Nqplo?gUu@5spYEh zR?wRXSSf|Xyxu9}524>N0Xy&`n(oJ<(yB)G8%q?we9q}M{WN5MKZS`XT>OSPlrim^ zeetu~PtNEN7{1k%(@Ez{Q<6G|l&=d5kFKHqpzHE}-LpQK;E_uL4m**dSyS{;(E!qB zj}fBam(%Cx zTbo+yDeR|yIm+oXj`gbC5j-tcLpxn;Q<%o)=p~es*9|Ct=bt=l*`jk5@8I|-o5BIn z?jCocPJ>5WFM8WAMk`a(^Brb1|847##R#`-6S+lYl8!e9HkhZv-i!(Ze_TQ50`EcE z6_w%ON|@cQpcl+>4wIPcvRw0%w{ynp{|)WQXk4mW5E9-*q`jymnXb1N>oRgFEG+Eo zBr}Ll28%-4lh@=#AxBjNsH9}>CW|@Y3XHvVd{SA5&jXJuPvnSWKPvy7r-~Uo#3(d2 z5ixsvz9M^c7CTR%FiL8w8BI-s?Y+*v^@h2M!c}%n>Um6Z=8~qynE$kS+IQG^LA?5lG9)ZCt30?{*a)_ekpIfz>n+vcV7f7Rg2Q2C>2iRv*}1Mf_iV&_zfq>b>VNiKZ2nT`BkZ2 zQc;QIFOVRgH60wJ{i`Sn)OHzeP;=-W^LAs|+%QzKu|Xh}=jiC|%2GZ!l5x;J;$*V-m%)Q>YC@YEiK07q#8`6%?c z(z&wHy&G(Tg7Hkt8}-6+-Lh)w3t88fEUTQ~-Sr-8JDb~F8^cj_3;nxA004Yyp9ImLMgiGX3KhH0&pVXqPII%FpNlNR zZcBwAB9g%@1=Ej$AM#P_9fG&mM@KiMez&;FkgXRomb#`nMnQ?{|9LKa$`(s z$1R<;9V$W8F?&0Z6m?T2QSE3rEIdhvrod1A{IOa;(d@R3gILt>^!z&1Q!%?e!b*5l z1!_bO-btaps56Q6X#ZO0BmwO+L;Lz8E-|W9u^Z!zN_i&;<@2GQV!AF1<;NY4|FCB0 z7B+Et5h{yHN@Bv>BP95erD2ZHn3^vWcG?2nx5xGa5FMZ>@6J>&RE~+xao{!1R3gzU z`==?Ff5>t;^-mvzgNeDRQg^ke(7#!;t@@5#?}D=gI>0)K zOL%T9#G2hLy3GE1RXOhK(V)28RRpW?!;9AwgbmKo(5nUf_bJVZaZ%ss+6f*@Y}Wpm zrqN9>v=hC_Ng(&l>_Ky)X*vt+?_1-oImb!98ws1x)tuh=gQ7zi(8(Y#dm6VsYP9d~ za}ckufsM^t(%xDWt1#zp?4b%7ukn@ae!=_Raq&V1TQnfi(|ju4;+pMm3;lqZkVa9< z-tOGkxl=Fa`XBM~Ad@M%(Guh~wst-TlK5Br+PJ#U3y~ObD$t{jt|^v2@nB!>ETVQ6 zP4s_nlCh^Oz#)5UP+@)h-e-YKxDG6QouzSwf0IyFXL~=E^-_Njb5!8lu*2)+GSYvmm|DzO2J3wf0(zDyc@Er7G>W5$c%$kx&e1=p zqfU6bBRzQSEsGGRNfHfCvqLs-xGzgo6&}Xuo>FktIJ(f$0fG1l%8oH&vj^9EE|*FZ zOO4V9oPK@9Iod8R&R*6wJ4Mg(;B}S$`EinDC~m(i{}eV;R4p8*+IXvT-bE%_O&D#K zChI^oF}XvZM2Be15AhdhI9FdICDDM1{=ZQ=#Bq_!X4Vp@E2`M1`e0WslVw$*BGR%| zqR!?vmp-oaHBrc<%`mp}?XP(AYhr!Ab4RX{PtDgB9frr#y{&N!rWECDmg^e_0w2PU z-{c}6UfZn5KMbpC9TOdNhVQLdbS`O)9HhFO2@3?O>8GjK31Msxq|Le@^7qNHU<_Zbt@u8-ce3rL5({RS!Q|#^`%ecFF+(!gz8B^6FyFET0~gERNQFHlLSNw+w4^ znN*lfDDl>9TqHkVVcVa*RdEQWLSbS0R{XcHZ|$;$Q5CV|z=^iyoXj<@Nan+L3Ie>| z{YhaiW0MMu@m|goDKoDJe3nLY&u3rPoboAn^Io;y!r^SJWX-;_zn*mlvuWv@5s3)yKPc zQBxS2SHjqAoTbCuCJg}i5YQFwyp*DI;fjYlp!+}bgQ8_?@AinzeDc3zI;;F}MbUIS`zBb-^gE$nG z)+c-QK5A9{QU~9Q4wV3b~?>X`O{?#%>V{8}Sx0pm3rSzejH9YxM zRR3N=kDetVPTb)t^m6;R#7I)oOO%Lq4-B1|o`Ij4tKQ<5?i@EeYv}qewwKsi4Z=Pb zOdZ&~=m)M92lbATfzw^hlB~2EZP{T>DIplC41)OPIe0H#8$M}`WL`04i$(=pHShG9 zx=i9Ju^t7b-c;Zg_YkseN9GuwMD#U@3AS^^W^(zD&(k z0Z9Pyp&9sjxHg4j$@$o7l#qB>AXt*Im(V2B<6=7)_(ds5T*g5^ONpMTm+EN!N}XNw zWNf&$Dw$nJBR%!hE?ij;c$lkrTk7J#9|#7=>}`Z$7*ev)6^_&2n_fZClZluEdDEZl z4O{+31}Yn1c_*E(t3%=Z`rpfY@%mo7XD2oB-P-kkE6e1xym6bdR30ji7Mc`z0?0U% zMf%&bLqyMJH9Yam^p8h!M5&%LDU#mm(C$~v+8N8#q&60*%3kEd8NSt?T5XX-c2Wk4rte;ROTpHV7G;w^)r^D3prF}tn~c4h{brepzn(r);%l@I-8XC zdRo3hIL8ISJ9k*ow~P5X{cC9Zv`cZli^6!P&42Of5ZbEcvj+kL8JII;Nm|{{D0fUP z*FP*rtGQPAm=CiSD%Z!wTU8YjmXGHLjJB$AwOEcG4AvY|=Cn$HpRw+;iNnjVvy`ie zG~SOL)@WOstZna~6*4fo(CRbpDVx;D?WMH2eT>(>SnO9R3C_+oT!ruiH+ zH4`O=R|%AT_H#-SvtvZg+Gut}r6>Zy3h2{t^BkQAF3gV5C|^)?owpV*c2tHUZ7$pW z&eGms<$zDoR7tT8L|$&{Vcd0U=a;&-^t(r%$`6V=cxQMh)e-d}8uxnE%Wi~Hupal- z(L14=06}1K5tGgh=LA>bFseq8))u|J@1S<$gNvrg^g$B@?yPUWcUML&6&G<3vb4Zs z+_Q5tWFS!2=xy1M{@_;7bHi#!GGFukJnmfP5=k8NUGKqhC2Jtlgxc7KxTZW`h}Cm4 zjX^WR9Mrmw3vzHKbk zQ6X8jhuFQZ_I*il#R<}Xq!Qqz<-B@65F9#H@mx1Oisr5maeM|6mX& ztoKQKKi=)2NLa8Rb+q~6R7EQ8AyOD%+C+b8nn)ef$U{h-vv>S@G!4J%h@bxyMz!J8vRWz`JslO^j~5C;shOK}p< z2aoqW2UgmaTO>uHkYta6+S`$pzv#YR1yNBiB{^Nlo0p=NDX+XmyjPT?u*QAxt(NRf zKS%(918w04zOxtO?RE<*_WJ2*hc5xm^j>F~xcqb0go;WuO<>(Z=F?4Rm1*!$2-+;f zVPLs%{xG*R#1Q!z0vb)BQk8=jvTtn^3{z;AYT3M9Q>_!IxVR7o+L4?g2!68d9g4{@ zGv5()bGzbht8ccstUMY;l@-lwik>}(!FM$^79XJ7{Iy;5)pme;HeywxrZfA{olw4t z`f1aw!?opg=qn%Wn8t8optgm?z|O`Vx3^sL9N;9ao^7X)5Tv6)cGn#e=QUr=)Yfq0 z4(G6(HoqwI+<97P$82NZI68Bd(u5+RY6n@34*^R$`lcEzj08msscllyY1LD{#>Xut zSC+W8BbtFYW2DzF+649UUJIDh^WJX^V7&I2I6rr`o32}mW;f*Jl-k{f6pP<*mT6SG zgmPtb>xNCdda(8$LcY7`ItGCV&GR@)1=ozIv9ZbOtbRzO3%9ueg{~(f5*M^NFA5e) zHh$sKq%j18ufPM|yU^4|H_4#R36#U&_3t@4bAisbn=4~g8{HTQ1_n=@kLoAoknPZJ z&T!HYT0{~WQZ zyv83k<@lHmD!+}YixP>ifEYYps+EH^O%doi26*abJ>)gP#^O_3MeEmZ~v z{3itF*xkDa*JszJ?(Mp67xA93i!-;}T7C|KTYPfb$ZWaeEe)RN8)K)j@m+!U!I>EH zC*&G%V-sJ~SnW;Lt7X$~ZVw?W)1lvK4){)fnL%wLQmVE(+Qhr zEJ3kWiWIlK)nIZ{#sHWA)22{A^Q8oHQtYsp)#VbjjJ+}pti+X6S5cT98ZIP;$#mPu zE!%jbDR)t*G=hqzVCQPiU*QD$?L0TrzEL?rX;oU$8KZO`b|~z%!L^ zh6Y@ft|pmpagmC@s(sdVmn)|cZn;TKDY`7#}o zsAP7z%bz!ZD^gbEH1EKhv$SR}gJQLd@|xq3OodUSKb`QmeeQ$5iy_~4j}uKaJH||R zzGqN=6m7MUNLOPLMc%*R&XXzBxjYw`jl0TtqwH;`rw|#Aj$N)4l__&~?0C~46`X^2 z;tQ2cyBs<=Qq9fi863Z|bTbO&gpFKvrx=#P+-^MFC+wy(0>Wd#^jFT8ywFDDsp95p ztMM|O7H2d^)+oiE1y19sffu=p6Ul7l$9nAM%(ZZixp&(US;{S_I6}ug*(S-BxB~{c zyeFu(rdOene>hD<+QA*XYpqw^N0Rh2wfn_S_DUq%M>W*+5q7C?V7W!96~NESsGk_? z(EHa^CzXW9?uIqC8^%!FPQ9CizRtW0=a9M#O+gQ{ zw=uh5zU4OPlK4-(WP?E6=##BYSwf5(Z2%W$DzT<#XY`DIMBtwR-qNlnN}y5c zUc{0{bz60xMw#v+uhD6|$C!rPDJMQ}wQhaajZf=Fs0K^vTlh_0%_$d#1N*q^IV0q1 z{-9ysId|)5RPD{g=#&9kC29ntPM2IHZK@&I_+d|A#ohlZQZ{`kgA)Vh}Ta z!lg#dDr$llqCh9I4N4ur(%gX%n>jjd&i58 zgT$kJ!}1&2Dw0J6Ric=IAP`zz#dT};hA%oT%Ej&21D$8NIgbr^4Nr4_bmNn6aij0> z8QO6ufU+tNZA18>Zze3`*1@djCl1Y?6jk3O)Lz?=-Lh|Dx>R=M*QC~xymc}>?Z?em zex9rR5l1TJ0p{p4=X#*!wBBa51n6qt44MAbTUT@3mYZ`r+k5gO9y>edrNq1vM3ed^j$ zOW4OZV43$;ubF~}RR`PCs>|geEQQ2t^;~$8tS;G~195PoK10BctHbVMbb`@kxtW;e z8x|`w&dou_?U}l+)@pK7ao1N}OW3GAn#byaP32MQpEnWCv>ZGQ#(;o%BTjV>Jv9il7@-&BNH8M8e5YPE| z`=(@9!fLpC$1%i19dR!S$}O%-?ptTqhW7dFt2N!8)d|ID{HaSa0cZXv zf9aw($ej}n@=9Hb1W)gV@E>pfFG+=qmsfSil>qCz7fljs46*dPv;csU{7rcSnd!WX zrHA-m3JUQYEx?sdP${0>Wnn%7_T`3LJ^kNWkZP2Wc>zr^d2mZ1FGQJyD1WW>QGPi& za{%y>ckXj$tyhwnxkAT$S+7iwZqN)cnJhOOG46;*NG9~`!;pk(_=vS$Zm>Fb)T>5) zJ==x?qnFOIv^#2VI3K<M=aG`D>Q>eI~4^`{d}w5bM^k8Ql7WP&p=%CLLAAj|eR zS0LAeJhk8R`Q>hr_lU{gz3+yn(hyU+QW0$SNqGV@h@tnIO6wDjk? z)g^UCGhT~__!SK#ta&L*)=|F{>RMTDhP^xOILt!|9UgTM@)M7H!{}wZq1_9h%I+0+Bq{blhag^fH#0{VM*^=ym7#H#Xa1=$SfFXG|Km z2DSF-kd{c{o3w)oP{KwE2I^Jx<5+zlwNOII?WL|D_pSw$`txQ7V~@H6fjHmRHGj8$ zb%(vz7ZZ4Z!vt8#a##sjq}0PSRm54;B-I;df8vOx@b_q;Y88&cs4VNWO@1;zhpFE= z28J<8s)}&jju+Pw`ukdgVv7#u{t=%f!@zQ|FXb;iEe33|TxuZDyX-*xaD!uG0OViX z-AyR{8cfjH9@yi?_<~I8gHT6z$Q!zLnwNxuVVSX#av&2UF)tjt=bhu)FSN=Vo1@X` zL-+>buD+QXC{U~US?*BEQLF!Wtm#Vovl2?2yOwwIhW459zdvrkHX0AxkRi+#?Q{sAy#H*O>gWS4V;OxkCA0ZMO#T3FKS${CKY9IXv*}_ zsMp_=n-D^Sqvc7o1mi1XzFTA1zs=Pf1I6NUo|sZH_N3GWK6~Gc;DJ%ex*loa4~E0{ zd-BOUM(o!yugA}WLT<=DtrL-71ez_WI)^3Eia36z9&`9<^2e<=V!eDobs>TV$7<8l&U2^aHe*_9Ff ziH#u27fH_`ge~OJFV_gw-uhZK(Z@a9zWi$t#Ol%yb}Mi9nSLaB0r0~#HKAKqwy}i; zg9$WXe0<@X&x~sBo*ef@&6uaZ+0=S=H{=Tkh{UD+_*n)oZ~Ja&Ld}&|*%;^iO!!F;4GunF?QT^K>~!EQ=5H?E`7~=_MYqdG2|0e;A*;o z0N#bd!c?3{Nt>9CGA+ zoyGBG(yM6OJ67+Nv|^U$#Fu#bL}~r{O>Bp=H3k|a^%uH^s=fI`+fk_u1d6-IJ<(EgRiFNhDvUjHCwV`*uNhVv@FNp`I!c}l#^;~bOZ+X-OIPp zll`q+kzm*$lih1P;x~qC%Pz|+&&VZc*72BL1DX0h1kwVXj7dVu-)>bpSqt-q}}Y7^1VWG^x8qqFO@fq38rimt{; z^l(kkC$;QSMr(XwXfyD7Q)eQ1dlZ@(hi-y-XSP-edeaWbqJ;gEOHvjZ!_TwyU8u*gzw{>lO|+&>%Ant7}WqT zCL<1bvmu0SdQ;8H&#pCnTmvvZwP=IZiMH+ba}=di^>cZ6*rf5T}x`^P?<>m(j` z7p_`as{jJQ4_itSsS;a!M246WPmIc#Q2ydLN@5Xb0sL=-(kc=;6{p~e zse?yeR)O&o0Il2GuAW>YH1^lV6wlNfIub?Y#oVRalY9)kRVM4rpYvHw1^=mtdoB=ZgQUeYNo?FfA(->5s&gBOKRSJ{K%Dt+8?7UdqC_Ri~+` zQWs(>Az|(zj0|XGq%f=JcGZuNfG);Vy)a<;ZQUn$ckFeG!a3WxrT;MW^Wg)p%|gIv zOMjxKJ_`l)z#qzTjCDN2|Ki8?EF5y{`;(VOr>sIl*uwGUhas*>_eSU-sxPVWDra>nG#OklDuMax zxxe8_iuHS-xBFT1N0cP%!`1GM^A2qe7Iw!kbUWQRN>T}Ifg=aVB)5AOeIm>TB1Q;@ z!OK1bbXWrF-A@{Ju+`}*6brK*YaH!i0h*Pt?#eqG#;taNK20J^*=mtorswQn@Hnf6 z57|hz8b&&@bAz0wGnKp;D5n{crE*>|hs8oNTP30wN!`>*;+FGnV1ZN5a-g;Z%s&h@ zTeuIxiHQt9{d_)$!TGYV3uVee*lDrqLT(qTfAend*M9Zu16<@I>l?#&fF?O%HJr9N1*wAZKcJLoxYly9bI~JY>f@+`3l*A-e$1+1m+*` z&Cv@^npC-=8P6}Eb1nwkLNJ))a_V}5#G7_U#Z*2zI#-6xUa5iz=p6fy7bU1ObyT>w z;L@EEGvsL5c9p=*ExWBYH8s^_xaA`=_-$jHvM_t7jObvhR)1oaX*O)}3#+==E#zE~ z_-u}>3$cZ#B#u^HgoP%8Kwj%*BBb8;=xf1O>pJ{qE>;uM*)EXyHuV&@GD_eo1=nTa zlFP{|ISG*lSuIU8ezdI(@nl_Mkiu9z1-Gt`H`4g;J#B8nMy3(~J%X%Sw#vx9N1e>t z9G)1vl_vf&E0~YNVG(&bK-x0=kQ?FCmXl|`oo5K3^n3 zLM^)2eN&JJrVosXJZR5$5C^G$3YK&?eF$F6#w#OBIvWZJX3!ujY^u_GV9MX8 zhE7|b&P8OBdW`PJ*rf(UHr}8tPU4K zETJY3oW`3&)hsPFP_fw^DwPLW*so7A#>wq6Edxp1gH`Q^LW8Ui$=o|tzmLApd7%R_ zSrXZOA|`%sFbNbV+F&&%Oe{(Z^Ix3|oV~fw&Zw+`QnGIksw7*Ak!TJ;^kRbcW6#nW zT{6Ys)l6t+Vf|e5TzTMRP8$yIkBQ9=NZg9^E7YPGLaM!v96Ds{sAvDpI#uH6)%4Ttx7NCpO+eU;mp*WOxNui z{tP_-(cAHs6_}_?z46Ue+=u;tq6KMS^whp^Rd8}x0qAlvNd8VM?*ZHyM+F*8-Loc! z^Ki%&T&=XCThuj+C8rWJco_Ft8uvEMByF_ZC`t!tttG3);_zbZdTyMRsJMzxl;6trt0Uf3ZX6sqOFM;(eo==wvyGI$}>^LXdwA=P4-X` z9{ID2JL0k2@zNU)(gSI)qki%Kx8$kbOLrtF+ii!$3Q^@dqxRL5N)915foN$i<{Qga zK7{8=&h>gOGQiI+CSo^(ZIFeCRgKd|`7|0nyN>52zCE(k$#N-CiUaU^Vx=RqVy23& z&|%=aVzM9%_w+ODJ9I%8W4tjCYDIf`>=mVU#=aSjaw#-zwH8ewcz8Sa%7fI$!r=lmmzVhs5hm^p?B7 z+kM+@1i3t=Xx(cB-6C&|k&*pmH(9oAmb=tO;>@N1 z+$u_YszKenF2*6;3(vKtB@@KG_Yk z3%A}~=PA_;npQL@BcWR_#XI&%4h|4+>A(QfnHI3@o2Oa;e~?cLb>YfRE1~)+-R1K1 zBtz83d~vUkb=?049In3JU~{eD>wAuUXR_}{QSE=RA_`wGL(auwQ-WRM6t$Ja!xP6# zLD?ZH=<*mTX_~;NeoV^-m$q2uI3^)&G7P|x#VEZVif6}zkm=%~-*CPHEPaX9bRk;utOgZ>) z$=hzt3r%}C3WkJJ-1rJPodAhef+q{-)Pc-U9?o%eBIEZLGXWa#1~V7 zWB)5fyv(23cFw@F7P7EaQtsk*y&e^Ce`hfo>tY(dR3!fDYP{hlLH3?v)aGdPKu&ra zqWTJL=xHlfaP>uUMT#EOVeL!=ZIm}O`p}0x0pp0v2)thQOnqp5vn+MgC-Kj4Pxit7 z$7c+EU?IVH(XMqhWOR!!9;>-2zB>&Mm1glK_i!XZs7Y^VUCmp8qHu(F17)ddc4hxk zJLKz6ux2umz9}W$M6pH7I~3#fo4$QdM|@@y_n!=#6M5c|NfKoFG$$!COLb#x3ARZ` zW3#H0Rk8z%p@D9_!G%I5_pxey+~IqI{3=E&i>|jNX}CNIo`iPA4Fs%1!`>x}%>g!6b!4Dlfc}Kj%4~_D(NPvaf|Aj$~<&e0r$ICgb>OmFACTxzt@)H*zsz+;@u67MQ=pMDJA$S|%i4EPFt zNqBiNus>bW?0I(~%*0E4oW~_Ci7_t-DK?;RHE3~pU4zuPj)2PU@}+o=_tU~qoxZ>c zFCFJ(S8CA#i37s@L+DxkYES)P^MJ;@TJb$1JmvRK$6no!UuAp1F7M6VySLuGD-<=Bu5R`$j$Nc7vyl z4)D?ioo`o@g@d}_pZQ-}-0mK8(WzVeTW0 zQ-C7MIairULLvKHJT^8jK5@f4)~Ysm5F*Hn9DbEzdtdp`$@H1+wW>C?sg_1$s@x?Z zcXdDzw%7(T7OD{U2_beN>~IEmm)Fg1%MuwRe}~M?FLbp(QPn92mfSq=TW79D50-X4 zp7T6g&i>q77OKm<0>QMce|UN3LKA~5{lNri=}%7i>uy~u-aL_! zxb;yG;ns+o0uE{C;M#8)%J7~%R=#Ms=P=L!7`ji>(t)r z`!+aU8-FJJ*kye6A&|>@Q@uVz3t@m?Bji1MFoMd4)ORcT0@I~aq!hz->hA;vcxSLsX%a%1`ehxO z53Bq=dmrAX_?L!;YMm|ZX_$B0$i%Z4>>Em|60y8uh09M6b34JyTYxv}({&k|rRv+0 zrP1Ft|Qr-Tsr z@jdq+Eh{pazdWSZ%XmYCN2^>oMkwDaL>LFsNr(nPu*_v{Uzgj@M(6ASngvbvFXM+l ztcC7xdkqGCkBAPCD+t^$wb;IlgeB_LFogA9jXOK9vw^|w8y+m0;(hTdSKfSj|k@inYABW{#`tu-A&vn_s!S$fX9@s$W0=+7qK@6G#^35kvILWkJJ^MC~@+ zuoO@Ce)^ev;^p)MhBWD%=i0*42yx;t$#z!IF8Eo14oUZ#RUKBRF`_6$cp2D93Artl zp37$C%%D%Vr?a%zA${Ag8*`T1d8A@k*8|BZ%=ye_$A)gw);1sd9$37~M2st8{S-M&S}PjdOq%suhI!M~ zeOdk$&wOX!Y9EbwrF9n$?6xH3<(L$?9pI;%5k#d0SD77o}ko9FVq92drWmZY}i zbm@Q>C34Q?JQ`W*ty&&Sh|NlUPCZzFFYK8CYnj1CX4Vqyh4p4Eu=2eC+G!?M&{4m8 z^qjvErRN257A zy__igcVt?*ZZznzE_>q0QY)8M>!!>p8f(Gqz}f(*~*BInG<8 zHuMW*@u7Jn;vv3x+qpbB+i60n>19lKw%3Q||Vtd9Y*PWGL? z`4pnV|9 zuTT#ny>iB1GIR(!`F@YYXfi)7@L*JtF2O;U*A^u0wO&X?Y_u!Cy;C-3(T-%gI>!Ix z33t~1?AdX3kGt?!;4Zvy4gc^PP0>aNJ@@`_?}GU4b^JKFr#Z-Gj%bBX_VUZF_~U);8raC0XNE_WwE^4>b*ZAbK89nfb!bqM z76)!^BTM-1-BIwA%dHQvGjl{iOycsG)5FQ_G8aq#8rw@*w{doMP`j%I%h8j?paf9P z4*1~z0TF_;Bt$OAEMjP~_Sx9N!qmcaPj{eP3F$mwIe#|`GfeW;Vgq!lU7QBYSR(5T zKPZ+8lZn>RZoGV}(;X41zz%`XW%%F-u`>Ht|MGfBJ$hMjY+|VQu1AJB{}r1uCuXx? zXT*ggcA}eco}AVy!?b!d|X!(cw|+=FEY~I;*+t>kFJ|jETNg9 z)Xg;*6|_cp&P_z$9N_oVpN|%Bb#WYQA8fJ-Ut%Jri3{eWqsNGP<+wNAZ; z)=8o`A8Wz0Rj^>oYe-H5t}eZnU|9^8G#=1v)Tu7rGirT>P)SD;O3j4HimN_PRr=@* z)jfP9z&wD0owB3IP4i@GUdL7VU0q(!9~iu0fH=kZpBHuw(FPlR{05%DBWL+RKoFJ(|c= zG*ksVSzXJTL)D>+-!+$uXt{z-XHyjn*O?#JTYny&M>7RCdL9F%QtR}3B9dUoGBP1Knv((`9kUOl!t2Iw!4rRK zX0oJ%UBThJD!4OMXK&r1os&ZO1s>N+X;2;M66Ztb+v9s!lAmbkunq@S)O34f3;K@U zR7L6J<~#!!03uW^POqyt$LnuwNZI4I>@z(-o^?26gsTymRIqAK=PyvKeD(Oox;IY` z?vT28GtoYlUs?Nuec7!vtb;6Rbq#zZZ{-4E7F$>pSG z703?dec$WFY9uie?$YqDf1%DDZqVPWvzT68dB=Q(bNmh=5UQ7y$|+hUTc86aul1yt zboB<%tkuQf*UWyep%!J!NmUA*{2hfC8{Vsz@10y#+&Ge!r)6(B!4Kw*oUB{7tp*^> zEV@on+yo20&-FM#!q;De10O*NzTTX#9Coe~75(y0){X~!4~#qBq2jmJB5j+T!*L=z zY=_LwSGX#DZe05YCk?9+jGlCPRk%8wy5>JW?#QXRIIDCs5wicnWG|E zW_@7dlgelsO*gCT@76V6gguf+zbsv%nhbJarO?0TDEnBjVrS9%l-M-Iefz{@C+uEq z+&Z4LjQMf-oY!i<44r_Jf!mjGN59f%hwTOY@9QgP3<>veVyLEPnJ&)%PL{K0qE-%y zm6j4}-es7!Y?t*^9S^}*t`MVPj$%*Qy?2c(3)uA>YZ>v--n$USx!wK!X*V$lyGE|o zw(I*w#MjKY?G?~Bx@I58+6frqkXOmmO^1HQonPU0^RGN zrR+z7WQugssX6~csz)QYm~es&tUdC7Q%)C;+;EJe z#koJJU|GXSqQukg4F2V{)};TTfdzn*8JzFQ4OmwWWK?=)mAqx2Fx_;2*5RS$Tpfj5 zDusam7AZYT=j2!|SJe+@lgm*24*IIK3o#$bK_%0AE3)&tulb9YKQVe9y&~bQ8lG>} z;0w`LXiqvH=hezT;n}$6wZRsOXMI9>bzi8JP!sG; zw7z@Y2#2-ByJyETR26eGmKW?`vR8o8n!@5q{DTI-;p7Y*tAY?$kQ=xG0{-dYFx5Wu zJA4Unx@%R+zY$>-Rql4eF9V9uYSpcOo6J$Imlteu9Ye)r$UG>}uy6el^|p;rsawK- zYHBc=vHbC=I9%XmLeb7?nJiDqaA5ljH$SxpVcxt%7s27z<{5nEsJd+?H$TvWpIO>T zrrA9`0#$IZmP+67P~)fIOkp>2VnY#vGWZ?(BC9rMr=PzVxj(b@Ks{H3|bFvv)R61l$Ph$^8b+L~y6^IE=s^5pGLzk?5& z61Y><2Y;uMDD}ku;vni4J4t0i2v`ca$N?3j>~lM*uX123)+8B#eD(mN^DT)9M|OAT z=Qa_=splCn{e{X!SXl2vjqhO{h&SsN^da)-(j-t%i3hiQ;Ij=K>`gSih9ho1NOn)> z=JaIKPNX=&#`IhoYiFxK8M?p`^vvdJ996=gm1maqE&QBaO1Tr-sjF?QO-u94ZhDh+ zp?2Ks2qmVX|9zL*v&KRwzGh#!G0aqg=>HiIJgo7rqrK&?hcaszU6re7WNb z)zHonwSn)g&A@M?kvBnH4J-Nx81P2?&FK^3t@k|+@Y$XdNzmCxI-~C<9?fdC+OiMGPtFW~*yiTgm1u zuSjg11q^KKIL-0sLP{^i8kceDHh^(HJ@W=?nTtkd4G>=Svm!tZuu1$4noA1x^la;W zBrP-Ng+)T3i_g26+i6(-xR*TVS5>z+E00JrYnP zcHPB&9f9n;q~l>POscSA=J$_E8^hxj%l!CrGelnOOgwwP>ke5X;3}*bJUuV%MUcgb z_#2Zj(InaaX~9JOhvLD2FJbFD)!f&;h(QD_xFsmNhZG=HJCG8BQ9nK!xm@KRT?Ng< z!%r@JIy%>(_chYLeLEoA1R&pxB@Noob_(j_Z7Ju~D)Y+Lu7j5)Ut^%z1TV)NWD(oh!*T{I#>aTBJ`d1h@pe z^49=L+iag_T@Gw)tl_`yk3KgJ)n+dWYJsLe2D^(nw>$ltWeu$j)qn+F8gOkx^Ce@x zOM@cqRZ0WHB*Y`JDp~GtBGn&MVA|`{J)Dos-3qyqUOPDskiZH1Wl~p@D9Nb;9M3ZI z=KSKebh<*0-gCtC?I5>BVLjUXdMHk(gJXp$F=`!sH)$CjQ-g+`O(!9SL={_0beX@u zOWy!_gD%RKXm87oo14&7NT5%ZjfE-3DA~rIl~iB)v0YN6F)0Xyo3y%a=aBM*p7Q#` z3tVPCKCXzV)AlBKd26s~J$skDq5>_@^Rfqr@e57QWFGA@dM2YtYs<{}$klS9wp{6rsfKM^mQ zqMilY%ai#e11QkwUzwJ}*n$qowDT25BL zi-t&EotH;3C0so_CH@+gmMJPR)f4yO!6BT(5tjV;Vd0`BV2TL(0lC6v6hjmFXx@>ci^PZKPQw8h(A%noz%a2-fM(weg;-ybj{8rq| z2aR8rPI0vMx8wp$G`IeA5aWgh^RKWoEHC{eo6_b?9{y40pjn?+5t4AfF=PL-aYwh==lbU5{2n zdu_|ju$T>US+zRcw(!a=2+_V6eR`=jR6e7@b8u+*xA9>Pjv1Ftj?7qG$kGYC~K$uk%IRgci1Z_ zauswX5(?#a1*w4_UesvrOOSag{p@L^3uJ5_8~7W`x-4Wx4K04onRh;%OX6(>R!t2M z5R_a3Dvl&Ir4lZ z(b~YPBw5nB+;2TZveU928fLjL;S$++z&u=WcL|^tbleRGB#RZU7WqN?W_+{11@+9! zEBrO{BT8#dD(F$I_vGQ|`ZGKq?laA}pQ)K4dvVB5Y9}yw+qBOmv^`S?&Z*7%SIP{I zH?cqLHG-(-q`jELb<&e4n;m!JE%}9@ja;GYXy7?XQhE2R5s!b5pv(TM zoOr-xwQM>SMZE_gU)zDrie8GMvltB1L3gy-kR*y3;w}Nu29;;kVZ1sV`2F;K$()Nx z#7d`h&EQ|Uxm{^ZY3<^o@2L}x7sX}PFxpEsG%_BbpEGWptIAsu4{x9Lsl{6!%#5sq z#Jk@t)-&U#%_j+{Q7P1k&F#K&(-X;OE%b~Z%oo+ z;$t%l=jG(Evdaw^Rje>r+txHER>PCXupO=~8C(&mreX$wPWN+HenM7`-|pZ{Qaq#d#h$1n`#YP4{g)z^ zUNTUcDZOO4S+l18ne0*my=6FM^>aop;C!=YR!le}lxuHW-7I0gKP~qOF&_zlNJ4#g zOAbd9*p%&Jd+{!FJ(ff<(|5}@?OmHN`JCFrXR#Bk#9zJkrCru|*af)zg^Lga2k}qa zt!70%(~$>@&g?A9WAE~K$q=@qLsOp^n+5rLS(wtKsZ>ZiL?;O=VKir8Cs;S_Jk?~vZt6C*V zeJ#_QrmeQ%>%{g1#KIjT6U6_P5kG(DFe^wpFIv>c@L;aFxhb4@##_`CcO#Bg)P+&F zt1=K#`rA|cH|d!*2i&7(v^`zQ``pqydOBYN(!2+vt~gnhldN?r&?oGoeprQi+0u6@ zp@g8<^CuHdAWo`NKX{STZy+nUK3hTIg;9e zk(*D9zr^KCWTt^eTcy&%RGu-Fp5@wlRveL(_vZN;ONm=ioXnF-^7qZg+Hy)nJHLMD z;1GTV*6TQo=6B%)g8vkUTOjhC{DS;20S2J;W$Q$ri^(Ns8z&YJT?&R;rd#p)kVMiq zJ@cF~r@Z}`eZ(^^8tP{`~Sxn32%B(>r<+oBgFt74G*=8o+!x5hc zH4C<&It})4=&)_T`VZixv<^BmJbWH^_xDA4w-(De)qSpZQ9btYP4}TN`I}J zLDRcjGdQO^wzcyH9rlrgd|fsB}#Jd7LQf$EUOCPrQsXX6Xc`9?gmnD_}TQclVp zAtlZXvN(>rX{d4@DhI%v5x_nk8GE}wzo+DUJs;anSNCTX1epx3MVw!M$u=VVQF&PN zMoL`JcE0XPzle8TmkhqUA7QxiNYHtz{#}h(0y_3Zkb&Di1Zom!SaVZz&twL>a##Ap zC4B6NX`5ezCu6ciZpXL3!C%znBDpwHnlPnuNNnX&#Cf<-Wst9hR+Wd9X&L`lO_0b* z+ai>k#)BxinzQt9Z6X01>r)Lx7`gas?FyF1kz~imE^^S!<2d<;=I4DZAk``!)30)x zyn)q5+rsBe%P23+%-B(xpf)^X4X8HA-l>xWQf@IlNoQPh%e_#yJ#(rc(Tu*y|IQw8 zy^vsS>_#gcgjknpMrxW$`=F8cGs2ZKeWlt!BimAWHE%)jO=i!C_&nFr=(CTh z!BHaDP5Y@IP?yflvnkp@UtoawF?mgV1-K-ATHDWZez`(Hezs|Dv_*nrOT=xjd3>RY zdrE2x59>U43o(rJVc{sz|q9pmG3OJy8HUSBmf)*)|}J|VG7;n>M9NCdfjyHyU< z?(c>|nA+yC#TmB|sokhcZJaVim6eYFP<{ym4kc+FA_d`f^ocv=3Qi<`Tr(%RRTNUB- zsh&zF^gD9$BZ?Ny2Z*td?h4bIk}I$IfuS1L_w&6Y5`v(u9m_89P=AsB%dikeV1Vnf zv>nWYksE{;p4Lq13EdbOn#rcC7&(q^`uqSSM*XdgqD4iP94ekMwD1gTvFUl);r?NP z*H;mfCs^K^jQUTBaYJ~6=pJeUu}&HH=NGc49j(I=b{^UYqUMV|{GgYxdQ#Yn+DnVL zFd0%}Vi;m`mVByFGz*~xQ;|8P@y$0(fc6`C?G6t_vr1=%)9Y<1IMJ6HTdIO5E0sr}QO6GzL)Z)`BIhZ|TAw0esrqjD zoCeyUJQn2iC*dG{GCcqrzm^+RU3#zLs>u1O3rECxqSmf!V$MHi=+~XcYw)WvCQqQR z&7>39>z~Yq9}FUhvoV#NDBMXDlas=(4^dwUR6jZN1e3U=WmxP=U)xRO3DH-&hxa=g zlK2vs)K*zoPHr7Wb*+b8*SQ>yT-<=h%M}XXQ%SMDt`Xi#;X(y1G4Q3$SBVd2E zpMS)MkPMP}mDt|JT5-x#&4i#XC1W7h;X4fOjf@=-^n#h4CN3X~L8?n9X<1L~C!|(W zr)XN7-JP#8qNsxtq8{YttatZBEp4(u3=Ng*B)V=5d{pgBTikBn34r@)%stIUhgTuH z&+k~_ZWUl9VS_!}L_aFb5Xnt5vGkK(?iczD6W*!oSxqVt3^6Q!c=8Lhr%ysy+ zOVjJW|Cts|0r-P<}{P{#p(9MM~P{apXATPO|5vT zUgkdfS03HmC+*mQWVo%qd{0y551l34Ts_Zf*@;q8j$D;CfezHH zN@td{uW;AV4E%T$L%VQ!4pGXGnBuZ9SZSjYkVb(U+vl-MrMkRkXpT14TDRdNx1UHqlBW`u?s^h(6lY@e+s!4&#YY?T#CaJHQRe`X2(Iz^t3<8 zL?02Q2*Go)Zs7fq62!Cu{m3)uHE31 z6Af!QnU5|Whr=CEE!Z7y8>Ls)huS3tZdzx^1i%m65UIfQ3=s?D?r%_qm=0nw1)JD)y!Nt4iCE!}VAxqarc@f?8rt|cDU@Si95pwPaX{Ib36 z>X&caiGY<)`ttQa1xIXlf|7IC7;gR;aik8tjB81VJ6wrS-s7Tg@W+~mA^T~VRm-W? z8~L#2%-aC}O8DwtN?s)2-u1@TfOGwS4G-#buW*LTS9?$keH`jEZKTZXB_@VXl(1{u z)-@>kR4$^#^!3zlTupTEY09&}3q~6=99910mW6B(rlKJk5}1V8c@9d9lNsyKsUQ|f z4$V*p2)hcAR#=YymVM^QFIkl++VR(rF&-zSvhctGs^0|^r2*^GGd^@Zur9fwQ}1|U zSXEQ`Si<)LxK+eUdgsyB&DO`{NRC2DA$>dhTGFkbdDSFJ>*#d)#z4CVW=5`8+UL#c zd8&pMSJS}(GH_-q|MQE70=I;6N)Kniaqz{jCq}~i$0*zsePgb>2J;nR;`)yRB&sT4 zlvVu&v4d%qS+#>lF>{hJhGF4~7?}2iqqH>Kqd>i=fOFr!%T` zep`!5th(ba#aiS(=~3dq4oIqF`cutpkrQl4VSnCzzVK&m_zC=~Ee3GAZ*!i; zy87_wnG`k8jm5!5*j_PZGs~K-Efe*B-v9ZRm=`$|TjIEzd8br@}+1)&N-z2RMRm) zGnWy=--juU4TWYmkxFE9#u7O@igI#)N5jmI8%rx|b@gvR4jUBD-e2+EU5G9!6u~U+ zF4N1hj#Uh6K7!`iA|`iim7mV^P_h5xwYEhcZfIf&aCIBpaFD% zzFT3?yZx{3J)8jj(rHg&MZ-VH=LffGC7vCW2)zMe?XfCQk9C zs%S>IweJZ?6?{1; z=Y+V235jc7yMB<+#1B|U?L}>HHDxWET*9uh2iE5NqcVaC6FrXx8S?0=DQougGEN^c zEePS*qelWJSm#TpC`^eCwn3~M%A)oD>(Om5smHHl8HAkL08BVO?IB^mA9|(9#PZ^v{qH{U8N*mZ7F zj&)Z{Ut)dQnia@}H0T!b=lX*2tN!l!(Mp|2rM&zTPT}%Ws*F9^WZ; zi-RYVNIwXLsK}?9xUg(7q`PQT&wPVM6bV>-dPrWAq$PcU9wV2trbSbZiDqkp?2uFu zhLaB?#;Nmp2QWxww98`qmYl=D^=y+)O<+)tNUC^Ai-4MZv`c#Z^=W)lJ<2F?MQ zV@K_jmrpJ%_9ByYplI=+x#_=-4hBp-8z=KxYf-|6uO{fAr5B*ROAPz$ja@#XDJB8x zpgh!cdH(@ce?*=X)qz?5^I!b2rm$dAm~^|f2gs=|>u9uVfNm)eR_~4u z8<+-mQa`G;0|$KQK#q|FxQzTm%JA-!frO`u( z+nE!OQoAzs>F$oBZlHg>Nl_qOI<|Zx59`bKx1Sr#<)NoePW$^#^i|s))Ms<-`(B<0 zF=Nd~B)2q@acJX1pja9Ts;1RHe?|Hb>(f~){^^(HUR5;}rg(l`y#mFalpd~7Lx=ze z$9XPQ@&(vc?M+8iczF1zTYFiY2W+WVu=8GampZ=ts}IT?B0aaMl%xUzZ>m*IkcH81 z5}0T|c_LF?ck5x%C{3Bv^R5?$W@8ck`15=b_%Z<2kVyWgzpu}w(3~94Fyl?ytiUl@2OrF80_tVPU zPSZSW_U*YEr>kEnsNpsC&i8^Nm731jA7f!11XDP`7Wd~gxJuu3Df!;si(d$-0yPsp zT`j7pas}-~PCkcM2=(?31fWe{t9)^3ITaE;Yze%P-a`IOBgK|)r&wLx>bC-~HJHDh z+n%U~NMBNSwhurLcgvBPsJ&P2z?=<=QJgWd#zn(sAAh)!2@{`C{9&?RP)d18*;Gxh zh{L5oj^gZh2E_abv0Z6NS~XYhen{vJVvur|vd*@r@G$|>C-2$YIpC!0QDh8fAbMzV z_aswlT@8I-HwkZ{%$~RlEEPEysVW)~BEYg)T>k z$y}9!)LAcFBvDP1-OlRX%~wxS(+dto0F$Wib`-B%eMUw#Z+{k=UGDxUVX?}H&Jd~R zZ&0tGB~OA1b{#7dsg4}SvWlhs!FZubfW>d(d*r701Tn@b;FpPIe}hZMebm(0veGUUK_*gdf4b>9xVDsP7~6Pt=PoYoQ3(5LT4$@h~Iht5|!7IAm-|`%oE8=`-JXt zj^V3A(C*>RMQ+rWz?8DfS}l(o+s!pmiU$J33|_t%cCrI@E^%b~n|DVS<2n=}kf(g_ za0pii)9R)?2NsbufyuWW=L;f4iTF`EJWe-0I8(KP>{xJGGSZs`LC z00vbVs|_DJe+c(F)Z~7WS*Nr=9}C~}BqiQL`4-5nFphQ#3z$)UPhG#3@|uk=`YUEd zoA+`Uu_T(oXLs}tHYXFfaI2wpoV5roG4ed-H;>41yz~-1x|;kgLL)-xG*+xWQz}ft zbo4l%J=uf#jn2;L+N|$`=4w6lX3F>59=sf*6+R}+(A|+eL1t&?yvQL|cT|aEEi0d) z(lhyJlUEu5gQpbJ57I)KMcPH5}y^)AmKI~C<#*0q*= zuR+=dzx61J3)aI>>`-3GAIS)^XJF*X?)xKyBEp4%i(2S6v(QIiy`#t_YU88zgCOyB zY4iq)d$xbFJ*iDe@hLH%HA)WbwClR^=K_D}Du@m~?br9&R9vh~kDIOJ@W73mYu9zM z(+;FBauJAZU+0ha`lN{r3x9#wJgGOimMne{6WIKbnP22L--pI%R_?a%pL|%@4kZWO zZYlHopW|ldgoi??1k9iU7Gi94GA-H!~r(Lxx`dh$)AR?jhbR zJ>N-;y8-w+Q2VFf$LA*3ewvAJQz<2|^6K`|4+a`Hn0aG}v=~Qe``@`-*F5ft>A&yX zc`r)W1L3b^?o1tBY}byR4$3Ks6r1$<`dinx?&q;$62qr29JTC^goYK zl|Z~Iys8A7`B~8){eD30p1rGL=N`Tp+^4g;TJZ_7#S+8f_mA8I+%H;xFq-WtqN1E< zxlly;FIku-s@w)Y^*L66Gu67gYw7A820T5!NYfe9`(+c*xI1y<-GKITi$}`SY6EEG z4$NkS|4o-`Ki**?JRo-b!nc=S%B^7;f~wB%YvdNtC1*gMze_*FrPyv0Yizf6U1-Y1 zND-HFw<4vOrz_jM9j*M1%^7s#uky3?PxkPl9pf8qOagFeV1OSy%j^NhW7^*Q<{p$? z^+6*mh5>QfJ&nJ}9r?M#qIwmt*uLg*vUFjBkXl@oGUcOKwAp0wRLkiM(0qHiGN~pZ z>)gZiZu{;X^eQk0(746lNZ2K(DdqQIu1f5NZCAHx(ZuiFkiNva|A*iuT&!_cPS(G9 zVKewnw6vETMBLUY$EQMzCbpOz1LhSE-`ZlV0`L4_9CfcOfg0QT&*(a17UrCN`mw>t zT?1{hk$KDMA2%TwHUKR2mv5Z=q>(^xDLiw^pHKA(7n?>~zgUYWFut?l9oe*l*1O`! zhSmFyQu1+!LzM~Yy6t4?_*+!)-4=BJ9S||kL|J3<#-OO}D?zbB-*JO5-~9yYIbT6R zMfMk;&U(IJ4C3~0=M1+UhI}4nS60@OjC3zX$t&mm(yRUskH+c9c$HRju~X0 zVnCpV$EX$6hvo%ii&Hs|$*~TYH2qT6H3&8BZT-1)(;Czl@^q$Tgja+rg%UnX*@1De zslR{9&ktdWQdYCH(G;ND8spv$h<`>tV&Hsay;=WR@EO_j=S(CiTHn6OR;bv@Ry4ho zNP1-Y3)@F<_UmUCKa6cPkDt%@PSxae(xOSvM^rui#Ai zINAhBmaLI|5TE|i!{ZmD$6v-s>->V+Xf9*h2!gt(2(#{QjQ5DQUh1kZ{8jm`9%JRs z9ePAnX!ce(%)PzZJV+K?8p+^UjIpr2y>LtD(&pVU$88jnDitl~mlD;%<%xcEaF@Fk zk#T5rjaJ%(;l+p8N4@;{N!7cjJA2J1ab3-HW|TzeZ`zhVO$wDdJAQ-!)C0u{bTv`Y zjoPMuXMyY3%a#$&8mXCUM|JWcG+LWm76WHB5)BdIVa*5Ok;lY9B`zaP=^SkBp7;9- z>b6U<>pqPiOIyFv8C9~*(E};Be*cyqD`r)+DbHvZL3vMQ->ZtFH}_STv@2_uBp!kU znW!y$8kT4(YsZ?XC#yd#QfnC~63v879^-urwn zsu8FZ<)jrxLvX^#PE4LOlq_*#Bkm%PNZ8_i8L+SRnP2>eYS-@H*Kc)Y<=y4paDedo zOE-6Q)8t6aH`PRpmSkCT-Cx9?Li7fwFoV^#4;Rw@IgXaOkEw#XYQfJbR&-s9#i7FK-BM zQZAfAFpBF_%|Z~X{ts%Jrho0uFiE6J6ZwsXVkV+@%ZLB;E|xC&e{kgguQCoAB*&aM zHn{K~bTQ8ebDkBp7`5;5YP!D))#m7buTXO3IQ*LnT}5|?^kEea?(~uu$Inhp_i4SB ze*~U56;|YmN7upr2lSYtPQQ>CjXN37X#WGyu9k36#q_i>N!S5Hj6;fVS;~=in>MW8 z6F|(PVK!!adg*)Q-&4LcU(~|{AkUJr&JJCK{4I^KnLV5*4mLhni|jvc@^_d_yulco zF)xcc%kS=cjVfq9#S8X>X!?ppQ7LY(0`j!;y+1n0bzOQm5Kt;E&$_r%MyPro;Pp;lPLg>@L1(0CwV-SR)H#U8}6 z=w{CRJ+=CykQHY+w*J!!r&EShi(@hK{-*k%+wre~Y~-3qV>5I4&v+Gb_gY&;EA{gF22PzXk1-z}JFSrivYjnvMGt`z^v9>u&P$#!kB#J`JQEN{ii=lnKg)h-p;Zw!$IPg> zXx!GZ_$KA48jJE>)+g3MF-A0xgrw2v8q?{SS(#6*B|G8qF}p1C@+4iInf`OA-w(Bl z1Fj-^TMo7zwM_m8xY@sVyveF8u8RrHANfwsW70KfE5jub_ja{&S=A(yGQO`fWLQt% z@J{+!M(+WBq5G#9H#LzAsml>&ENuKBQsm0Y%kz=ctGKSsf5QJ)v`Pw{{joD${O6`O znKU4zRKAxfMrUz`mOkm?+gi58s=XBQjsSn-V7vd00-Ap}F2;~39dMSG`Agl+*@i4( zINn-Hh7OUd*YTa)-)sy$9_0zt;9&YhmD^e7;t|uJsXE7U#QFEW)iI{Zf1K%<@3yVb<0ewIwlQ&M7}pnsZ^1F3*U7f- zG8lBX`^9R+2bz{Hj#J!TuPuWl{s|s)kMQ^mMoa!HX#8*gftgu_|8Etbu>LDHp_u^G zXj*y@Y`(#~^FS`Of##Lw%t&9+c-QaK-4z-9#z${WW&UVtCu!fMa<$H^u3-RqlJgD` zled2$Pi`H&7o7D?s<%>SXVO8MP7s=rseOQptg#$Qr% z>^G{bjUW{XVar#IP+jqIp4}Vi{}Y)jIbV$aDyQgv0=IEM`xKv&6O|{wl-S44Iwpb4V8$=?<8Tu4Jk#k0&!yiXvdt+x{|#GXB?JT;$^%NI zZlV5$YXlQ^$}$DmZ_diZvTjmcc`_z^9t%>ZpSzkVDO_A){-Usfrj#+$w@2n$-LN}O zm7o6}oLM=E+t*xNw;-+BZHSY#P8YPjwd14#Kir>F^xyXf4TQws1WFp1@BG_IT%s-- z<+d{TPXl_UzWgjuu)>ajSRAkEfw@4Wx(gTr_I=L6^77qD zW(pmYynLfZS46Z`_4=>n_AfFTX-xv^w~bQ&jp@#@>rGa8IIk+f+>yHhk3o+y2N`ium~jP6f7}n+gL3ZyzP*iB zQhra8#b@*~sXcA4wk@_H+;U)B=87M*ivn6S zx0CtWK~+W*eSc(GK5*V#zfD_SejgeHaYAu-kf_08W6~aCPGg7(dwT(otI7Su$<6g* z1TOnKsyghhw^q<0MpW(*4S55cG$Vd}k@0$pm)D6u%Ea&q=hjXty^#K2H01(sM~$?; z)BE^u_4sF;_i^UIJg+Usxu#YlQZ4AwjWK=`#3w3OU|1O)a_`USpWWKBO5+U1MGUn=|I^Zx;vlw`30 literal 0 HcmV?d00001